feat: complete evidence restructuring worktree

backend/test/pi-managed-config.test.ts

@@ -0,0 +1,28 @@
+import { expect, test } from "vitest";
+import {
+  PI_MANAGED_CONFIG_ERROR_MESSAGE,
+  configuredPiProviderApiKey,
+} from "../src/pi/managed-config.js";
+
+test("provider credential declarations are selected from models.json by provider ID", () => {
+  const raw = JSON.stringify({
+    providers: {
+      hosted: { apiKey: "$HOSTED_API_KEY", models: [{ id: "one" }] },
+      local: { apiKey: "local", models: [{ id: "two" }] },
+    },
+  });
+
+  expect(configuredPiProviderApiKey(raw, "HOSTED")).toBe("$HOSTED_API_KEY");
+  expect(configuredPiProviderApiKey(raw, "local")).toBe("local");
+  expect(configuredPiProviderApiKey(raw, "missing")).toBeUndefined();
+});
+
+test.each([
+  JSON.stringify({ providers: [] }),
+  JSON.stringify({ providers: { local: "invalid" } }),
+  JSON.stringify({ providers: { local: { apiKey: 42 } } }),
+  JSON.stringify({ providers: { local: { apiKey: "!must-not-run" } } }),
+])("invalid declarative provider credential configuration fails closed", (raw) => {
+  expect(() => configuredPiProviderApiKey(raw, "local"))
+    .toThrow(PI_MANAGED_CONFIG_ERROR_MESSAGE);
+});